NT authority/system

• atulyan.aries

  SSCrazy

  Points: 2020

  More actions

  August 26, 2020 at 3:07 pm

  #3783797

  In our environment someone is using nt authority/system account with sysadmin permission

  I have checked the logs, event viewer but not able to find how/who assigned this and when

  Is there a way to find this

   

  Thanks

  Atulyan

• John Mitchell-245523

  SSC Guru

  Points: 148809

  More actions

  August 26, 2020 at 3:11 pm

  #3783798

  Atulyan

  Check in Services to see which ones are running under system accounts.  And remove NT AUTHORITY\SYSTEM from sysadmin so that this can't happen again.

  John

• atulyan.aries

  SSCrazy

  Points: 2020

  More actions

  August 26, 2020 at 4:12 pm

  #3783826

  is it services.msc

• John Mitchell-245523

  SSC Guru

  Points: 148809

  More actions

  August 26, 2020 at 4:13 pm

  #3783827

  Yes.

  John